Skip to main content
Version: 1.5

How to add a custom certificate​

Prerequisite: A certificate in .pem format

Goal: Make a custom certificate available system-wide

This is for certificates used by system-level services.

Kubernetes workloads should bring their certificates within the container image instead.

In order to install a custom certificate we need to

  • copy the .pem file to /etc/pki/trust/anchors/
  • run update-ca-certificates

The respective cloud-config snippet looks like this:

write_files:
- path: /etc/pki/trust/anchors/my-custom-certificate.pem
permission: 0444
content: |-
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
runcmd:
- update-ca-certificates

(actual certificate content omitted for brevity reasons)